Splunk Enterprise Security Expert

Job Overview:

Pay Range: $47.00hr - $52.00hr

Requirement/Must Have:

• 8+ years of hands-on Splunk experience in enterprise environments.
• 3+ years of direct experience with Splunk knowledge management, CIM normalization, or SIEM content engineering in a large-scale deployment (20+ TB/day).
• Deep expertise in Splunk Enterprise Security, including correlation search authoring, ES data models, and risk-based alerting.
• Demonstrated experience managing knowledge object governance at scale across multi-team, multi-app Splunk environments.
• Strong proficiency in SPL including complex statistical pipelines, accelerated searches, and macro development.
• Experience developing and enforcing enterprise naming conventions and taxonomy standards for Splunk deployments.
• Proven ability to create and maintain technical documentation such as runbooks, standards guides, and architecture documentation.
• Background in detection engineering, threat hunting, or SOC operations with an understanding of how knowledge objects serve analysts in practice.
• Deep administrative and engineering proficiency with Splunk Enterprise (distributed, multi-site, clustered).
• Advanced normalization across all major data model domains using Splunk Common Information Model (CIM).
• Full lifecycle mastery of Knowledge Objects including field extractions, lookups (CSV, KV Store), macros, tags, aliases, event types, workflow actions, and saved searches.
• Experience with Splunk Apps & Add-ons, including TA development/review, app packaging, and deployment via Deployment Server and Deployer.
• Proficiency with Splunk Admin Config Service (ACS) and configuration file management (conf files, btool, precedence rules).
• Awareness of Splunk Edge Processor / Ingest Processor for pipeline-level routing and data transformation.
• Experience with multi-cloud environments including AWS, Azure, and GCP for log source integration and cloud-native telemetry normalization.
• Linux and Windows system administration skills.
• Python and Bash/Shell scripting skills for automation of knowledge object management and API-driven content deployment.
• Experience with GitHub, GitHub Actions, and CI-CD pipelines for knowledge object version control and promotion workflows.
• Knowledge of MITRE ATT&CK for technique mapping for detection content governance.
• Knowledge of NIST CSF / 800-53 and CIS Benchmarks for compliance-driven requirements.
• Experience with Agile / Scrum methodology for iterative content development.

Responsibilities:

• Provide centralized oversight and authoritative governance of all Splunk knowledge objects across the enterprise SIEM environment.
• Establish, publish, and enforce enterprise-wide naming conventions for all knowledge object types to ensure consistency across teams and deployments.
• Conduct regular audits of knowledge object libraries to identify and retire duplicate, orphaned, deprecated, or conflicting objects.
• Create custom automations to track data ingest, consistent flow, and drift from normalization standards.
• Define and maintain a knowledge object registry/catalog documenting ownership, scope, purpose, permissions, and lifecycle stages.
• Collaborate with platform teams on permission structures and sharing models to ensure secure access across environments.
• Lead the promotion pipeline for knowledge objects from development through production using CI/CD and GitOps practices.
• Serve as the CIM authority for the enterprise, defining and maintaining compliant field mappings across all ingested data sources.
• Design, build, and maintain Splunk data models for Pivot users, ES correlation searches, and accelerated reporting.
• Manage data model acceleration strategies across all production data models, monitoring for search load and coverage gaps.
• Define and enforce source-type and index taxonomy standards to optimize search performance and multi-team usability.
• Ensure entity zone enrichment is properly incorporated into data models and asset/identity lookups.
• Maintain CIM coverage matrices across all logging domains, mapping fields to MITRE ATT&CK techniques and compliance controls.
• Design and own the enterprise Splunk knowledge architecture, defining taxonomy hierarchies and classification frameworks.
• Develop and maintain a Knowledge Management Standards document covering naming conventions and change control procedures.
• Establish and chair a Knowledge Governance Working Group to review standards and prioritize improvements.
• Define content type templates for correlation searches, dashboards, and reports to accelerate development while enforcing compliance.

Nice to Have:

• Splunk Core Certified Consultant.
• Splunk Enterprise Security Certified Admin (SPLK-3001).
• Splunk Certified Architect.
• Security Certifications such as GIAC (GCIA, GCIH, GCED).
• Experience with Splunk SOAR (Phantom) playbook development and orchestration.
• Familiarity with Splunk UBA and behavioral analytics model management.
• Experience in healthcare or highly regulated industries such as HIPAA, Federal (NIST), NYDFS, or PCI.
• Experience with infrastructure-as-code tools like Ansible or Terraform for Splunk configuration management.
• Proficiency with LLM-powered tooling and AI-assisted automation for knowledge retrieval.
• Experience supporting Splunk deployments in environments with 10,000+ users and multi-petabyte data retention.
• Familiarity with Kafka, streaming data pipelines, and real-time telemetry routing.

Skills:

• Splunk Enterprise Security.
• SIEM.
• Splunk Common Information Model (CIM).
• SPL (Search Processing Language).
• Data Modeling.
• Knowledge Objects.
• Python.
• Bash.
• GitHub Actions.
• CI/CD.
• AWS.
• Azure.
• GCP.
• MITRE ATT&CK.
• Linux.
• Windows.

Qualification And Education:

• Bachelor's degree in Computer Science, Information Systems, Cybersecurity, or equivalent professional experience.